SC-900 Describe the capabilities of Microsoft Entra Practice Question
A company uses Microsoft Entra ID. The security team wants to grant temporary, time-bound administrative access to the Microsoft 365 user management role for IT support staff. The access should require an approval from a senior administrator, and all actions should be audited. Which Microsoft Entra ID feature should they configure?
⚠ Common exam trap
Test-takers frequently confuse Identity Governance (which handles access reviews and entitlement management for regular users) with Privileged Identity Management (which specifically handles just-in-time privileged role activation and approval).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Privileged Identity Management (PIM)
Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time (JIT) privileged access with time-bound role activation, approval workflows, and full auditing. This directly matches the requirement for temporary, approved administrative access to the Microsoft 365 user management role with audit trails.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conditional Access
Why it's wrong here
Conditional Access policies in Microsoft Entra ID define conditions under which users can access cloud applications and services, such as requiring multi-factor authentication, a compliant device, or specific network locations. While it enforces access controls based on various signals at the point of access, it does not provide mechanisms for just-in-time (JIT) role activation, time-bound privilege elevation, or an approval workflow specifically for temporary administrative access. Its focus is on *how* access is granted, not *when* or *for how long* a specific privileged role is active.
When this WOULD be correct
A company wants to require multi-factor authentication or block access from specific locations when users access a sensitive cloud application. Conditional Access would be configured to enforce those policies at sign-in.
- ✗
Identity Protection
Why it's wrong here
Microsoft Entra Identity Protection is a security module focused on detecting and remediating identity-based risks, such as leaked credentials, anomalous sign-in activities, or infected devices. It identifies vulnerabilities and suspicious actions related to user identities, triggering automated responses like requiring password changes or blocking access. However, Identity Protection's primary function is risk detection and response to compromised identities, not the proactive management of temporary, approved, and time-bound privileged role assignments.
When this WOULD be correct
A company wants to automatically detect and block risky sign-in attempts (e.g., from anonymous IP addresses or atypical locations) and require multi-factor authentication for high-risk users. Identity Protection would be the correct feature to configure.
- ✓
Privileged Identity Management (PIM)
Why this is correct
Microsoft Entra Privileged Identity Management (PIM) is the specific service designed to manage, control, and monitor access to important resources within Microsoft Entra ID, Azure, and other Microsoft Online Services. It provides just-in-time (JIT) privileged access, allowing users to activate roles for a limited duration, often requiring multi-factor authentication and an approval workflow. This capability directly addresses the need for time-bound privilege elevation with comprehensive auditing and accountability, significantly reducing the attack surface.
- ✗
Identity Governance
Why it's wrong here
Microsoft Entra Identity Governance encompasses features like access reviews, entitlement management, and lifecycle workflows, aiming to ensure the right people have the right access to the right resources at the right time. While it provides comprehensive tools for managing identity and access lifecycles, including periodic access reviews and managing access packages for resource groups, it does not inherently offer the just-in-time (JIT) role activation and approval workflows specifically for temporary privilege elevation that PIM provides.
When this WOULD be correct
A company needs to automate access reviews for all users with access to sensitive HR applications, ensuring that managers periodically certify continued access. Identity Governance's access reviews would be the correct feature to configure.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Privileged Identity Management (PIM)Correct answer▾
Why this is correct
Microsoft Entra Privileged Identity Management (PIM) is the specific service designed to manage, control, and monitor access to important resources within Microsoft Entra ID, Azure, and other Microsoft Online Services. It provides just-in-time (JIT) privileged access, allowing users to activate roles for a limited duration, often requiring multi-factor authentication and an approval workflow. This capability directly addresses the need for time-bound privilege elevation with comprehensive auditing and accountability, significantly reducing the attack surface.
✗Conditional AccessWrong answer — click to see why▾
Why this is wrong here
Conditional Access controls access based on conditions like location or device state, but it does not provide time-bound, approval-based role activation or auditing for administrative roles.
★ When this WOULD be the correct answer
A company wants to require multi-factor authentication or block access from specific locations when users access a sensitive cloud application. Conditional Access would be configured to enforce those policies at sign-in.
Why candidates choose this
Candidates may confuse Conditional Access with access control for privileged roles, not realizing it applies to user sign-in conditions rather than role activation workflows.
✗Identity ProtectionWrong answer — click to see why▾
Why this is wrong here
Identity Protection is designed to detect and respond to identity-based risks, such as compromised credentials or suspicious sign-ins, not to manage temporary, time-bound administrative access with approval workflows.
★ When this WOULD be the correct answer
A company wants to automatically detect and block risky sign-in attempts (e.g., from anonymous IP addresses or atypical locations) and require multi-factor authentication for high-risk users. Identity Protection would be the correct feature to configure.
Why candidates choose this
Candidates may confuse Identity Protection with access management features because its name suggests controlling access, but it focuses on risk detection rather than privileged access governance.
✗Identity GovernanceWrong answer — click to see why▾
Why this is wrong here
Identity Governance focuses on managing user identity lifecycles, access certifications, and entitlement management, but does not provide time-bound, approval-based privileged role activation with auditing. PIM is required for just-in-time administrative access.
★ When this WOULD be the correct answer
A company needs to automate access reviews for all users with access to sensitive HR applications, ensuring that managers periodically certify continued access. Identity Governance's access reviews would be the correct feature to configure.
Why candidates choose this
Candidates may confuse the broad term 'Identity Governance' with the specific PIM feature, thinking governance includes all access management, but PIM is a separate component for privileged roles.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Privileged Identity Management
Privileged Identity Management is a security system that controls, monitors, and audits access to sensitive systems by granting elevated permissions only when needed and for a limited time.
Key term
Microsoft 365
Microsoft 365 is a subscription-based cloud service from Microsoft that combines productivity tools like Office apps with security, device management, and online storage.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.